Spencer Duncan
A professional identity listed by a third-party registry of suspected DPRK IT-worker personas, cited below. The registry publishes no byline or methodology, so the attribution is the registry's. Values this site read from a live account are cited to the page and date.
Identifiers attributed to this persona
6 indicators the sources below record for this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
Spencer Duncan |
alias | |
spencerduncanpower@gmail.com |
email address | |
timdonerpower@gmail.com |
email address | |
https://github.com/everythinguwannatobe |
github profile | live |
https://github.com/spencerduncanpower |
github profile | live |
+13522344952 |
phone number |
Spencer Duncan
alias IT Worker Fraud CURATED
Sources
-
Transcribed from the ZEUS-DEV-919 working document, an unsigned compilation published as a Google Doc and linked from a repository on the zeus-dev919 GitHub account. The document describes itself as raw data with no filtering applied and asks a reader to verify every linkage before acting on it, so it is carried here as that compilation's claim and not as a finding of this site. Its persona table pairs each name with the address and Skype identifier the application used.
docs.google.com/document/d/1IdVIzSr5NOi76ugu67Ob3t39K6b4Rz_P7an0Q0M9HWo/edit — ZEUS-DEV-919 working document -
Read on 21 September 2026 by walking the commit history of every repository on github.com/everythinguwannatobe, an account reached because its Next.js_swap repository is byte for byte the one the account filed under ZEUS holds. The ZEUS-DEV-919 working document, from which this persona is transcribed, gives one address for Spencer Duncan, timdonerpower@gmail.com, and this account signs 1,948 commits with it, under the names TimDoner, spencerduncanpower and its own login. A second address, spencerduncanpower@gmail.com, signs 702 more under the account's own login and is recorded here as the same holder's: it is the persona's name as a mailbox, used on the same account beside the address the document published. github.com/spencerduncanpower also exists as an account, created on 3 March 2023 with no public repositories, and a third login, nicholasduncanpower, is attributed two commits in these repositories. The account was created on 29 October 2022, holds 57 repositories of which 17 were created on 30 October 2023, and its profile reads Senior Software Engineer under the display name BE THE BEST BEST!. Its Next.js_swap was created on 29 October 2022 with 13 commits signed TimDoner; the ZEUS account's copy was created on 16 January 2023 and its oldest commit is dated 1 December 2022, so the code moved from this persona to that one. Two personas holding one another's code is recorded as a link between the entries, not as one hand.
github.com/everythinguwannatobe — Chollima Hunter
spencerduncanpower@gmail.com
email address IT Worker Fraud CURATED
Source
-
Read on 21 September 2026 by walking the commit history of every repository on github.com/everythinguwannatobe, an account reached because its Next.js_swap repository is byte for byte the one the account filed under ZEUS holds. The ZEUS-DEV-919 working document, from which this persona is transcribed, gives one address for Spencer Duncan, timdonerpower@gmail.com, and this account signs 1,948 commits with it, under the names TimDoner, spencerduncanpower and its own login. A second address, spencerduncanpower@gmail.com, signs 702 more under the account's own login and is recorded here as the same holder's: it is the persona's name as a mailbox, used on the same account beside the address the document published. github.com/spencerduncanpower also exists as an account, created on 3 March 2023 with no public repositories, and a third login, nicholasduncanpower, is attributed two commits in these repositories. The account was created on 29 October 2022, holds 57 repositories of which 17 were created on 30 October 2023, and its profile reads Senior Software Engineer under the display name BE THE BEST BEST!. Its Next.js_swap was created on 29 October 2022 with 13 commits signed TimDoner; the ZEUS account's copy was created on 16 January 2023 and its oldest commit is dated 1 December 2022, so the code moved from this persona to that one. Two personas holding one another's code is recorded as a link between the entries, not as one hand.
github.com/everythinguwannatobe — Chollima Hunter
timdonerpower@gmail.com
email address IT Worker Fraud CURATED
Sources
-
Transcribed from the ZEUS-DEV-919 working document, an unsigned compilation published as a Google Doc and linked from a repository on the zeus-dev919 GitHub account. The document describes itself as raw data with no filtering applied and asks a reader to verify every linkage before acting on it, so it is carried here as that compilation's claim and not as a finding of this site. Its persona table pairs each name with the address and Skype identifier the application used.
docs.google.com/document/d/1IdVIzSr5NOi76ugu67Ob3t39K6b4Rz_P7an0Q0M9HWo/edit — ZEUS-DEV-919 working document -
Read on 21 September 2026 by walking the commit history of every repository on github.com/everythinguwannatobe, an account reached because its Next.js_swap repository is byte for byte the one the account filed under ZEUS holds. The ZEUS-DEV-919 working document, from which this persona is transcribed, gives one address for Spencer Duncan, timdonerpower@gmail.com, and this account signs 1,948 commits with it, under the names TimDoner, spencerduncanpower and its own login. A second address, spencerduncanpower@gmail.com, signs 702 more under the account's own login and is recorded here as the same holder's: it is the persona's name as a mailbox, used on the same account beside the address the document published. github.com/spencerduncanpower also exists as an account, created on 3 March 2023 with no public repositories, and a third login, nicholasduncanpower, is attributed two commits in these repositories. The account was created on 29 October 2022, holds 57 repositories of which 17 were created on 30 October 2023, and its profile reads Senior Software Engineer under the display name BE THE BEST BEST!. Its Next.js_swap was created on 29 October 2022 with 13 commits signed TimDoner; the ZEUS account's copy was created on 16 January 2023 and its oldest commit is dated 1 December 2022, so the code moved from this persona to that one. Two personas holding one another's code is recorded as a link between the entries, not as one hand.
github.com/everythinguwannatobe — Chollima Hunter
https://github.com/everythinguwannatobe
github profile IT Worker Fraud CURATED live
live
Source
-
Read on 21 September 2026 by walking the commit history of every repository on github.com/everythinguwannatobe, an account reached because its Next.js_swap repository is byte for byte the one the account filed under ZEUS holds. The ZEUS-DEV-919 working document, from which this persona is transcribed, gives one address for Spencer Duncan, timdonerpower@gmail.com, and this account signs 1,948 commits with it, under the names TimDoner, spencerduncanpower and its own login. A second address, spencerduncanpower@gmail.com, signs 702 more under the account's own login and is recorded here as the same holder's: it is the persona's name as a mailbox, used on the same account beside the address the document published. github.com/spencerduncanpower also exists as an account, created on 3 March 2023 with no public repositories, and a third login, nicholasduncanpower, is attributed two commits in these repositories. The account was created on 29 October 2022, holds 57 repositories of which 17 were created on 30 October 2023, and its profile reads Senior Software Engineer under the display name BE THE BEST BEST!. Its Next.js_swap was created on 29 October 2022 with 13 commits signed TimDoner; the ZEUS account's copy was created on 16 January 2023 and its oldest commit is dated 1 December 2022, so the code moved from this persona to that one. Two personas holding one another's code is recorded as a link between the entries, not as one hand.
github.com/everythinguwannatobe — Chollima Hunter
https://github.com/spencerduncanpower
github profile IT Worker Fraud CURATED live
live
Source
-
Read on 21 September 2026 by walking the commit history of every repository on github.com/everythinguwannatobe, an account reached because its Next.js_swap repository is byte for byte the one the account filed under ZEUS holds. The ZEUS-DEV-919 working document, from which this persona is transcribed, gives one address for Spencer Duncan, timdonerpower@gmail.com, and this account signs 1,948 commits with it, under the names TimDoner, spencerduncanpower and its own login. A second address, spencerduncanpower@gmail.com, signs 702 more under the account's own login and is recorded here as the same holder's: it is the persona's name as a mailbox, used on the same account beside the address the document published. github.com/spencerduncanpower also exists as an account, created on 3 March 2023 with no public repositories, and a third login, nicholasduncanpower, is attributed two commits in these repositories. The account was created on 29 October 2022, holds 57 repositories of which 17 were created on 30 October 2023, and its profile reads Senior Software Engineer under the display name BE THE BEST BEST!. Its Next.js_swap was created on 29 October 2022 with 13 commits signed TimDoner; the ZEUS account's copy was created on 16 January 2023 and its oldest commit is dated 1 December 2022, so the code moved from this persona to that one. Two personas holding one another's code is recorded as a link between the entries, not as one hand.
github.com/spencerduncanpower — Chollima Hunter
+13522344952
phone number IT Worker Fraud THIRD-PARTY REGISTRY
Line type
| Line type | VoIP |
|---|---|
| Carrier | SKYPE P2P |
| Block carrier | NEW CINGULAR WIRELESS PCS, LLC - GA |
| Rate centre | MICANOPY, FL |
Source
-
Transcribed from the ZEUS-DEV-919 working document, an unsigned compilation published as a Google Doc and linked from a repository on the zeus-dev919 GitHub account. The document describes itself as raw data with no filtering applied and asks a reader to verify every linkage before acting on it, so it is carried here as that compilation's claim and not as a finding of this site. Its persona table pairs each name with the address and Skype identifier the application used.
docs.google.com/document/d/1IdVIzSr5NOi76ugu67Ob3t39K6b4Rz_P7an0Q0M9HWo/edit — ZEUS-DEV-919 working document
Sources
- docs.google.com/document/d/1IdVIzSr5NOi76ugu67Ob3t39K6b4Rz_P7an0Q0M9HWo/edit — ZEUS-DEV-919 working document
- github.com/everythinguwannatobe — Chollima Hunter
- github.com/spencerduncanpower — Chollima Hunter